DevSecOps & Application Security Engineer
Role Summary:
Experienced security practitioner focused on DevSecOps, application security, and cloud security architecture, supporting a banking/financial services client’s secure SDLC, infrastructure-as-code, supply-chain security, and privileged access / PKI controls.
Key Responsibilities:
Design, develop, and review Terraform (IaC) with a security-first approach; perform IaC code reviews
Architect and implement deep technical security controls across AWS and Microsoft (Azure / Microsoft security) environments
Embed application security practices across design and delivery
Implement policy-as-code enforcement across the SDLC — PR-time, pipeline-time, deploy-time, and runtime
Drive supply-chain security: signed builds (Sigstore/cosign), SBOM generation, SLSA-aligned provenance, dependency pinning, runner isolation
Set up and operationalize Veracode and/or GitHub Advanced Security
Deploy and support CyberArk PAM and PKI
Contribute to security runbooks, pipeline standards, and process documentation
Support audit and compliance evidence gathering
Escalate and coordinate on critical security events with senior leadership
Required Experience:
7+ years in cybersecurity operations/engineering, cloud security, or DevSecOps
Hands-on Terraform coding and IaC code review experience
Deep technical AWS and Microsoft security and architecture experience
Application security experience
History of setting up Veracode and/or GitHub Advanced Security
CyberArk PAM and PKI deployment experience
BFSI or other regulated-industry experience preferred
Core Technical Expertise:
Terraform / infrastructure-as-code security and code review
AWS security architecture; Microsoft Azure / Microsoft security architecture
DevSecOps toolchains and secure SDLC integration
Application security (SAST/DAST/SCA in practice)
Policy-as-code across PR, pipeline, deploy, and runtime
Supply-chain security: Sigstore/cosign, SBOM, SLSA-aligned provenance, dependency pinning, runner isolation
CyberArk PAM (deployment); PKI (deployment)
Veracode and/or GitHub Advanced Security
Preferred Certifications
AWS Certified Security – Specialty; Microsoft security/architecture certifications (e.g., AZ-500, SC-100, or equivalent) as applicable
